Re: Question re: Macro Virus behaviour

[gjgowey () tmo blackberry net]

When in doubt use notepad to open the file.  Macro's are still going to show up as plaintext should be fairly easy to 
then figure out if the file is kosher or not.  If they're not showing up as ascii then I'd worry a bit.  Of course you 
could also just install AVG and sandboxie to open the file and find out without worrying about if you're going to 
destroy your machine in the process (I love that about sandboxie).

Geoff

Sent from my BlackBerry wireless handheld.

-----Original Message-----
From: "Kelly Robinson" <caliana1989 () gmail com>

Date: Sun, 7 Oct 2007 16:05:33 
To:full-disclosure () lists grok org uk
Subject: [Full-disclosure] Question re: Macro Virus behaviour


An MS Word file on your computer has a size of 356 KB and a modified date of 19 June 2007 3:37:51 PM. Moreover, the 
file has been certified clean (i.e., uninfected) at this point by an infallible AV scanner.  

After a highly-publicised virus outbreak, you examine this file's properties again and notice it is still 356 KB with 
the same modified date and time. Can you safely conclude it has not been infected without checking it with your AV 
scanner? 
   
 Why or why not? _______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/